Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2025-32951: Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development

30
Routine
MEDIUM 6.4UPGRADEUPGRADEUPGRADE

CVE-2025-32951 is a medium-severity flaw (CVSS 6.4) affecting cuba platform, cuba rest api, jmix framework. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded befo

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.4 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.4% (top 70%)
CISA exploited listNo
WeaknessCWE-79
Published2025-04-22
Last modified2026-06-17
Publisher (CNA): GitHub, Inc. · Vendor: haulmont

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

haulmont cuba platform UPGRADE
Affected: >= 6.2.0 and < 7.2.23
Fixed in: 7.2.23
Safe to downgrade to: a release before 6.2.0
1. Check installed version
apt-cache policy cuba-platform || rpm -q cuba-platform || cuba-platform --version
2. UPGRADE to 7.2.23 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cuba-platform
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cuba-platform
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.2.0 (Debian / Ubuntu)
apt-cache madison cuba-platform sudo apt install cuba-platform=<VERSION_BEFORE_6.2.0> sudo apt-mark hold cuba-platform
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cuba-platform sudo dnf downgrade cuba-platform-<VERSION_BEFORE_6.2.0> sudo dnf versionlock add cuba-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
haulmont cuba rest api UPGRADE
Affected: >= 7.1.1 and < 7.2.7
Fixed in: 7.2.7
Safe to downgrade to: a release before 7.1.1
1. Check installed version
apt-cache policy cuba-rest-api || rpm -q cuba-rest-api || cuba-rest-api --version
2. UPGRADE to 7.2.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cuba-rest-api
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cuba-rest-api
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 7.1.1 (Debian / Ubuntu)
apt-cache madison cuba-rest-api sudo apt install cuba-rest-api=<VERSION_BEFORE_7.1.1> sudo apt-mark hold cuba-rest-api
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cuba-rest-api sudo dnf downgrade cuba-rest-api-<VERSION_BEFORE_7.1.1> sudo dnf versionlock add cuba-rest-api
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
haulmont jmix framework UPGRADE
Affected: >= 1.0.0 and < 1.6.2 · >= 2.0.0 and < 2.4.0
Fixed in: 1.6.2, 2.4.0
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy jmix-framework || rpm -q jmix-framework || jmix-framework --version
2. UPGRADE to 1.6.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jmix-framework
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jmix-framework
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison jmix-framework sudo apt install jmix-framework=<VERSION_BEFORE_1.0.0> sudo apt-mark hold jmix-framework
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jmix-framework sudo dnf downgrade jmix-framework-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add jmix-framework
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
haulmont jpa web api UPGRADE
Affected: >= 1.0.0 and < 1.1.1
Fixed in: 1.1.1
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy jpa-web-api || rpm -q jpa-web-api || jpa-web-api --version
2. UPGRADE to 1.1.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jpa-web-api
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jpa-web-api
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison jpa-web-api sudo apt install jpa-web-api=<VERSION_BEFORE_1.0.0> sudo apt-mark hold jpa-web-api
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jpa-web-api sudo dnf downgrade jpa-web-api-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add jpa-web-api
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-32951?

cuba platform: upgrade to 7.2.23; cuba rest api: upgrade to 7.2.7; jmix framework: upgrade to 1.6.2, 2.4.0. Exact commands for each OS are on this page.

Is CVE-2025-32951 being exploited?

CVE-2025-32951 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-32951 affect?

CVE-2025-32951 affects cuba platform, cuba rest api, jmix framework. Severity is medium (CVSS 6.4). Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the

How urgent is CVE-2025-32951?

Priority 30/100. No elevated risk signals yet.

Software pages

Spring Framework vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.